PT-2021-22459

Name of the Vulnerable Software and Affected Versions ParlAI versions prior to v1.1.0 Description The issue is caused by unsafe YAML deserialization logic, which allows an attacker with the ability to modify local YAML configuration files to provide malicious input, resulting in remote code...

PT-2021-15661

Name of the Vulnerable Software and Affected Versions: ParlAI versions prior to 1.1.0 Description: Due to the use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or simila...

CVE-2021-39207: Deserialization of Untrusted Data

parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable to YAML deserialization attack caused by unsafe loading which leads to Arbitary code execution. This security bug is patched by avoiding...

CVE-2021-36162 Unprotected yaml deserialization cause RCE

Apache Dubbo supports various rules to support configuration override or traffic routing called routing in Dubbo. These rules are loaded into the configuration center eg: Zookeeper, Nacos, ... and retrieved by the customers when making a request in order to find the right endpoint. When parsing...

YAML deserialization can run untrusted code

Impact An authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with a crafted aclpolicy yaml file, that can cause the server to run untrusted code on Rundeck Community or Enterprise Edition. An...

GHSA-Q4RF-3FHX-88PF YAML deserialization can run untrusted code

Impact An authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with a crafted aclpolicy yaml file, that can cause the server to run untrusted code on Rundeck Community or Enterprise Edition. An...

CVE-2021-39132 YAML deserialization can run untrusted code

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, an authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with ...

CVE-2021-34066

An issue was discovered in EdgeGallery/developer before v1.0. There is a "Deserialization of yaml file" vulnerability that can allow attackers to execute system command through uploading the malicious constructed YAML file...

amethyst_config (0.3.0), amqpr (>=0.1.0, <=0.2.2) +147 more potentially affected by unknown CVE via serde_yaml (>=0.6.2, <=0.7.5)

serdeyaml CARGO version =0.6.2, =0.1.0, =0.1.0, =0.0.1, =0.1.0, =0.1.1, =3.1.3, =0.1.0, =0.1.1, =0.1.0, =0.2.4, =0.3.1-alpha.2, =0.4.0, =0.4.4 and more Source cves: unknown CVE Source advisory: OSV:GHSA-39VW-QP34-RMWF...

GHSA-R6JX-9G48-2R5R Arbitrary code execution due to YAML deserialization

Impact TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format. python from tensorflow.keras import models payload = ''' !!python/object/new:type args: 'z', !!python/tuple , 'extend': !!python/name:exec listitems:...

Arbitrary code execution due to YAML deserialization

Impact TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format. python from tensorflow.keras import models payload = ''' !!python/object/new:type args: 'z', !!python/tuple , 'extend': !!python/name:exec listitems:...

Google TensorFlow Arbitrary Code Execution Vulnerability

Google TensorFlow is an end-to-end open source machine learning platform. An arbitrary code execution vulnerability exists in Google TensorFlow versions prior to 2.6.0. The vulnerability stems from YAML deserialization. An attacker can exploit this vulnerability to execute arbitrary code...

CVE-2021-37678

TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format. The implementation uses yaml.unsafeload which can perform arbitrary code execution...

CVE-2021-37678

TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format. The implementation uses yaml.unsafeload which can perform arbitrary code execution...

CVE-2021-37678

TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format. The implementation uses yaml.unsafeload which can perform arbitrary code execution...

PYSEC-2021-591

TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format. The implementation uses yaml.unsafeload which can perform arbitrary code execution...

PYSEC-2021-789

TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format. The implementation uses yaml.unsafeload which can perform arbitrary code execution...

PYSEC-2021-789

TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format. The implementation uses yaml.unsafeload which can perform arbitrary code execution...

PYSEC-2021-591

TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format. The implementation uses yaml.unsafeload which can perform arbitrary code execution...

Google TensorFlow 代码问题漏洞

Google TensorFlow is an end-to-end open source machine learning platform. An arbitrary code execution vulnerability exists in Google TensorFlow versions prior to 2.6.0. The vulnerability stems from YAML deserialization. An attacker can exploit this vulnerability to execute arbitrary code...